Truvo Free Tools

Security headers check

HTTP security headers are instructions your site sends to the browser about what scripts may run, who may frame your pages and what data may leak. This checker reads them from one normal request and names the SOC 2 and ISO 27001 controls each missing header affects.

SOC 2 CC6.1SOC 2 CC6.8SOC 2 CC7.1ISO 27001 A.8.9ISO 27001 A.8.27
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the HTTP security headers checker works

The check is passive: it makes one normal HTTPS request to your homepage and reads the response headers, the same way a browser does.

01

Query

You enter a domain. The tool requests the homepage over HTTPS once and captures the response headers. No other page is fetched and nothing is submitted.

02

Read

The result checks for Content-Security-Policy, X-Frame-Options or a frame-ancestors directive, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and whether the Server header advertises an exact software version.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.8 and CC7.1, and ISO 27001:2022 A.8.9 (configuration management) and A.8.27 (secure system architecture and engineering principles). A complete set is evidence of a hardened configuration; a missing header is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden web configuration, TLS and DNS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • Content-Security-Policy

  • Clickjacking protection

  • HSTS and TLS

  • Server hardening

  • Audit evidence

  • Fixed-price scope

Security headers check: frequently asked questions

It reads the HTTP response headers your site sends and checks for the ones browsers use to protect visitors: Content-Security-Policy (which scripts and frames may load), X-Frame-Options or frame-ancestors (who may embed your pages), X-Content-Type-Options (blocks MIME sniffing), Referrer-Policy (what URL data leaks to other sites) and Permissions-Policy (which browser features scripts may use). It also notes a Server header that leaks an exact version.

Truvo maps header findings to SOC 2 CC6.1, CC6.8 and CC7.1, and to ISO 27001:2022 Annex A controls A.8.9 (configuration management) and A.8.27 (secure system architecture and engineering principles). The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The tool makes a single HTTPS request to your homepage, the same request a browser makes, and reads the headers in the response. Nothing is written or changed.

Content-Security-Policy. It is the strongest browser-side defence against cross-site scripting: even if a script is injected into a page, a tight policy stops the browser from running it. The usual approach is to start in report-only mode, list the sources your site needs, then enforce with restrictive script-src, object-src 'none' and frame-ancestors directives.

No. They limit the damage when something else goes wrong, which is why auditors read them as configuration controls rather than as the whole answer. Each is a one-line change at your web server or CDN, so they are usually the first fix, not the last.

Response headers a web server sends that tell the browser how to behave: Content-Security-Policy restricts where scripts and resources may load from, Strict-Transport-Security forces HTTPS, X-Frame-Options blocks framing, X-Content-Type-Options stops MIME sniffing, Referrer-Policy limits what URL data leaks to other sites, and Permissions-Policy switches off browser features such as camera and microphone by default. They are a second line of defence when application code has a bug.

Those scanners grade the same headers and are good references. This check reads the same response headers, then maps each finding to the SOC 2 and ISO 27001 controls it gives evidence for or signals a gap against, and lets you run the rest of the domain's external checks (mail, DNS, TLS, subdomains) from the same place.